{"id":"PYSEC-2020-250","details":"Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.","aliases":["CVE-2020-14019","GHSA-cpcw-p965-wpqx"],"modified":"2023-11-08T04:02:25.004540Z","published":"2020-06-19T11:15:00Z","references":[{"type":"WEB","url":"https://github.com/open-iscsi/rtslib-fb/pull/162"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNMCV2DJJTX345YYBXAMJBXNNVUZQ5UH/"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00012.html"}],"affected":[{"package":{"name":"rtslib-fb","ecosystem":"PyPI","purl":"pkg:pypi/rtslib-fb"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.73"}]}],"versions":["2.1.31","2.1.32","2.1.35","2.1.36","2.1.37","2.1.38","2.1.39","2.1.40","2.1.43","2.1.47","2.1.49","2.1.51","2.1.56","2.1.57","2.1.58","2.1.61","2.1.62","2.1.63","2.1.64","2.1.65","2.1.66","2.1.69","2.1.71","2.1.72"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/rtslib-fb/PYSEC-2020-250.yaml"}}],"schema_version":"1.7.3"}